Oracle Helidon CVE-2026-71155

The attacker must hold a low-privileged account or credential that grants network access to the Helidon Imperative Web Server over HTTP - this is not an unauthenticated attack. The affected deployment must be running Oracle Helidon 3.2.18 specifically, using the Imperative (MicroProfile) programming model with the Imperative Web Server component active. No user interaction is required once the attacker has the necessary credential. Exploitation is limited by: the requirement for at least low-level authenticated access (PR:L), meaning fully anonymous internet-facing exploitation is not indicated; the specific version constraint of 3.2.18; and the use of the Imperative Web Server component rather than Helidon SE's reactive model. No special non-default configuration is described as a prerequisite beyond running the affected component.

The CVSS 3.1 base score of 8.5 (High) is well-supported by the vector metrics: network-reachable (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), with scope change and high confidentiality impact. The most significant real-world risk driver is the S:C flag - if an attacker compromises Helidon, the blast radius extends to adjacent Oracle Fusion Middleware components, amplifying potential damage beyond what the Helidon service alone exposes. No EPSS score was provided in the input data, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing was supplied, meaning active exploitation in the wild is not confirmed. No POC or public exploit code has been identified at time of analysis. The SSVC signals point to: exploitation status unconfirmed, technically impactful (C:H with scope change), and potentially automatable given AC:L and UI:N - placing this in a 'monitor closely and patch promptly' posture rather than emergency response. The PR:L requirement is a meaningful limiting factor: unauthenticated internet-facing exploitation is not indicated.

An attacker holding a low-privileged application account or service credential sends a crafted HTTP request to the Helidon Imperative Web Server endpoint, exploiting the authentication bypass to circumvent authorization controls. The attacker then reads sensitive data accessible to the Helidon service - potentially including configuration secrets, user data, or cross-service tokens - and performs limited insert or update operations. Because of the scope change, the attacker may pivot to other Oracle Fusion Middleware components reachable from the Helidon context, expanding the impact beyond the initially compromised service.